05d4d4810257af9d8a14ed1bfb0444aaa8d0bf167679272003bc7e9db55d57c9

Sharing

Copy URL Twitter E-mail

General

Target
05d4d4810257af9d8a14ed1bfb0444aaa8d0bf167679272003bc7e9db55d57c9
Size 522KB
Sample260820-kak2wsgr4z
SHA256 05d4d4810257af9d8a14ed1bfb0444aaa8d0bf167679272003bc7e9db55d57c9
MD5 7c1718a8a7c6410a669cc9c6347d3177
SHA1 665cdeb42e1e7109d15b2f310cf2e37a0af5fb5e
SHA512 15b0cb8f9fba94e6bfabe31279cde22d07c32f6b734a224f0e63a3e2a30024f2be681ad62a7ab0a4161059baad9185e13aa99ae192f70c987bdb0544d141d9bd
SSDEEP 12288:ayWZyjY6inyHb4R7YFIFZWspDDCyjP0K+ere1:ayWZgY6JcY+PWsluyjHrs
TLSH
T118B4230AA6615E7FFC82853135343B868EBF2F3953A01E570345365AFE72EE1920BB45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
05d4d4810257af9d8a14ed1bfb0444aaa8d0bf167679272003bc7e9db55d57c9
unpack001/$PLUGINSDIR/BitmapUtils.dll
unpack001/$PLUGINSDIR/DecodeDataPath.dll
unpack001/$PLUGINSDIR/DiagSummary.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll

File Explorer

05d4d4810257af9d8a14ed1bfb0444aaa8d0bf167679272003bc7e9db55d57c9

.exe 522KB
$PLUGINSDIR/BitmapUtils.dll

.dll 192KB
$PLUGINSDIR/DecodeDataPath.dll

.dll 67KB
$PLUGINSDIR/DiagSummary.dll

.dll 112KB
$PLUGINSDIR/InstallOptions.dll

.dll 15KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/brand.bmp

263KB
$PLUGINSDIR/iocustom.ini

1KB

05d4d4810257af9d8a14ed1bfb0444aaa8d0bf167679272003bc7e9db55d57c9

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 05d4d4810257af9d8a14ed1bfb0444aaa8d0bf167679272003bc7e9db55d57c9
MD5 7c1718a8a7c6410a669cc9c6347d3177
SHA1 665cdeb42e1e7109d15b2f310cf2e37a0af5fb5e
SHA512 15b0cb8f9fba94e6bfabe31279cde22d07c32f6b734a224f0e63a3e2a30024f2be681ad62a7ab0a4161059baad9185e13aa99ae192f70c987bdb0544d141d9bd
SSDEEP 12288:ayWZyjY6inyHb4R7YFIFZWspDDCyjP0K+ere1:ayWZgY6JcY+PWsluyjHrs
TLSH
T118B4230AA6615E7FFC82853135343B868EBF2F3953A01E570345365AFE72EE1920BB45
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/BitmapUtils.dll

IMPHASH e1d378174b1e4f5a2a5f46978161df47
SHA256 95cb52606f6780f5e7963e182c6a8ab39ecb1a8a075ace9c32428be6451946fd
MD5 c63f886913273e5db444362cad52dd3b
SHA1 bd48b833e8814334f1070a21ba94e24b109ea72b
SHA512 149260dc8faa305187706c98a0e993ff1356f12e1c506c41f12af2b8a873017c3e941c49993d10583d45e941c39ff2288ea924b0acf52198301df3c394171d6b
SSDEEP 3072:mg/nVBaS7VsfYv/riacnxAg0FusX5ic2c:m+VBaS72AynxAOg2c
TLSH
T135149E51B0F2C0B3C57F24348069DB555A792B250374D5EBBBE40E3AAF607D0CBB62A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

84373

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GlobalAlloc GetProcessHeap SetEndOfFile GlobalFree lstrcpynW HeapAlloc GetLastError HeapFree HeapReAlloc RaiseException RtlUnwind GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA MultiByteToWideChar ReadFile EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection SetFilePointer VirtualFree VirtualAlloc HeapCreate HeapDestroy GetModuleHandleW Sleep ExitProcess WriteFile GetModuleFileNameA WideCharToMultiByte GetConsoleCP GetConsoleMode CloseHandle GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetStdHandle InitializeCriticalSectionAndSpinCount FlushFileBuffers LoadLibraryA CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize CreateFileW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

MapDialogRect GetWindowDC ReleaseDC GetWindowRect

gdi32

GetDeviceCaps

$PLUGINSDIR/DecodeDataPath.dll

IMPHASH 67674f50af3d218aace550bb87c54e22
SHA256 453a94e53183c9eb0c7bf8a8a8cf14d40d1e2fc96bab5d026858a61b9118f418
MD5 3e2a7097f8313684626256f7c664c7e8
SHA1 914b54e2357968934791ce9cd374c02a5485cdaf
SHA512 fdf182924944a59e8d592b650e1974c9f1824acafdfe071b2286c59f13b89daf3e40a1650669a109a3bca388c20c8a827afb362b6b0e7e88ce849eff457e3c0a
SSDEEP 768:LfqOiM/7Un+uVYLjgazZ76nF+cuQU5bjPKi6dR82Le1pdiHweP4bllRyc+9:LhiOo+uW76B3Uv/2Le1aHt4vRyX
TLSH
T12C637B2079E0C0B3C45E99750855E7B0966D68149FF496C77FAB4B3E9F203C0AA3E31A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19467

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress GetModuleHandleW lstrcpynW GlobalAlloc GlobalFree GetVersionExW LCMapStringW LCMapStringA RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind GetLastError GetFullPathNameW GetCurrentThreadId GetCommandLineA HeapAlloc HeapFree TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc WriteFile HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage GetCurrentDirectoryA GetDriveTypeA LoadLibraryA InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW

shell32

SHGetSpecialFolderPathW

ole32

CoTaskMemFree

mpr

WNetGetUniversalNameW

$PLUGINSDIR/DiagSummary.dll

IMPHASH d21eb270584c4d9ec4ed28e8359bf22f
SHA256 5494355a2dbd4512124381094144534775e3892d495138a91176e4fbeb5f8eda
MD5 bcac2b71c7eac33609faabb611c76813
SHA1 292317077aa45496ac13036496dfc107aee21968
SHA512 0424482dda2060c8a4961cf02a2e560c409f1a07ab2327725209ba4759bf6857afc6b4004c4142a9a094f218c0294ed8356689d9a8c4cf5280444aec779b8dbf
SSDEEP 1536:e4v6XpG2e64Bprb7CRy1fqBA5aHtxvLnoDoXQmEWQgvocw/WFTyB5y:Xv6XQ5B9XUAaXjC9RctFTyB5y
TLSH
T110B36D2176A0C0B3C49B29394524CB695B7EB8359BB48AC7B7540B7E9F303D0DA7634B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24836

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

kernel32

Sleep GetDriveTypeW GetSystemDirectoryW lstrcpynW GlobalAlloc WideCharToMultiByte GlobalFree GetDiskFreeSpaceExW GetVersionExW GetVersionExA GlobalMemoryStatus GetWindowsDirectoryW GetDiskFreeSpaceExA GetDriveTypeA CreateFileA ReadFile GetProcessHeap SetEndOfFile RaiseException RtlUnwind GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree EnterCriticalSection LeaveCriticalSection GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement GetModuleHandleA SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection CloseHandle ExitProcess GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WriteFile GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar VirtualAlloc HeapReAlloc CreateFileW InitializeCriticalSectionAndSpinCount HeapSize SetStdHandle FlushFileBuffers LoadLibraryA WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

ole32

CoInitialize CoCreateInstance CoUninitialize

oleaut32

VariantInit VariantChangeType

$PLUGINSDIR/InstallOptions.dll

IMPHASH 85f08eb0cbec010ecbc287fa68321173
SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
MD5 7854290f8bc473fb9fad1917b0065731
SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
TLSH
T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryW GetCurrentDirectoryW GlobalUnlock GlobalLock GetModuleHandleW CloseHandle SetEndOfFile GetPrivateProfileIntW SetFilePointer MultiByteToWideChar ReadFile GetFileSize CreateFileW lstrcmpiW GetPrivateProfileStringW lstrcatW lstrcpynW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree WriteFile GlobalAlloc

user32

PtInRect LoadCursorW GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard GetClientRect SetWindowRgn LoadIconW LoadImageW SetWindowLongW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW SetCursor DrawTextW GetWindowLongW DrawFocusRect CallWindowProcW PostMessageW MessageBoxW GetSysColor CharNextW wsprintfW GetWindowTextW SetWindowTextW SendMessageW MapWindowPoints

gdi32

SetTextColor CreateCompatibleDC GetObjectW GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderW SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

05d4d4810257af9d8a14ed1bfb0444aaa8d0bf167679272003bc7e9db55d57c9

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/BitmapUtils.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/DecodeDataPath.dll

kernel32

shell32

ole32

mpr

generic

$PLUGINSDIR/DiagSummary.dll

version

kernel32

ole32

oleaut32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/brand.bmp

$PLUGINSDIR/iocustom.ini